Sheet 07 · ART-04

Exception log

Every deviation from published guidance, with compensating controls and an expiry date. Exceptions are normal; undocumented and permanent ones are not.

Format: Log
Owner: AI Program Manager maintains it; the approving function owns the exception.
When it is used: At approval of any exception, then reviewed monthly for expiry.
Retention: Life of the exception plus records retention.

Contributors: Requesting team, Information Security, Risk, Legal & Privacy

Downloads

The filled export is generated from this site's sample records at the moment you click it — the same rows shown below, not a stored copy. The blank template is the same columns with no rows. Printing uses this page’s print stylesheet, which drops the navigation and the download controls.

Required fields

The guidance matters more than the field name. A field labelled “risks” with no guidance gets filled in with “standard AI risks” and the artifact stops being worth reading.

Fields in ART-04, with the guidance given to whoever fills them in.
Field	Guidance	Required
ID, requester, date	Who asked and when.	Required
Request and standard expectation	Both sides, so the gap is visible.	Required
Approved by	The function with authority over the expectation being waived.	Required
Compensating controls	What reduces the risk in the meantime.	Required
Expiry date	Mandatory. An exception without one is a policy change nobody approved.	Required
Exit plan	What has to happen, by whom, for the exception to close.	Required

The register as it stands

3 records, rendered from the same sample data the rest of the site reads. This is what the CSV export contains, field for field.

EXC-01

Use Draftline for public-facing article drafts before the AI-assisted content disclosure practice is finalized.

ID: EXC-01
Requested by: Marketing & Pursuits
Date requested: 10 Mar 2026
Exception granted: Use Draftline for public-facing article drafts before the AI-assisted content disclosure practice is finalized.
Standard expectation being waived: Public content produced with AI assistance follows a published disclosure practice.
Approved by: Priya Raman, Director of Technology, with Risk concurrence
Compensating controls: Named author reviews and approves every published piece; Marketing keeps a list of AI-assisted pieces so disclosure can be applied retroactively if required; No technical claims published without subject-matter author sign-off
Expires on: 30 Sep 2026
Status: Expiring
Exit plan: Disclosure practice drafted by Marketing and Risk for the September committee. If it is not adopted, the exception lapses and AI-assisted public drafting stops until it is.
Linked records: UC-005; TL-03

EXC-02

Proceed with the Cadence Search pilots before the vendor penetration-test summary is received.

ID: EXC-02
Requested by: Data & Reporting
Date requested: 02 Apr 2026
Exception granted: Proceed with the Cadence Search pilots before the vendor penetration-test summary is received.
Standard expectation being waived: New tools complete a full security review, including vendor testing evidence, before pilot use.
Approved by: Marcus Dell, Information Security Manager
Compensating controls: Internal-only corpus; no project or client documents indexed; Permissions mirror the source library, so the tool grants no new access; Scoped to 60 named pilot users
Expires on: 15 Oct 2026
Status: Active
Exit plan: Vendor documentation received and reviewed, or both pilots stop at expiry. IT & Security holds the vendor commitment date.
Linked records: UC-003; UC-007; PIL-002; PIL-003; TL-02; DEC-2026-03

EXC-03

Continue using an unapproved meeting transcription tool for 60 days while migrating to the approved assistant.

ID: EXC-03
Requested by: Transportation Practice Group, Denver office
Date requested: 12 Jun 2026
Exception granted: Continue using an unapproved meeting transcription tool for 60 days while migrating to the approved assistant.
Standard expectation being waived: Only approved tools process firm material.
Approved by: Marcus Dell, Information Security Manager
Compensating controls: No client-confidential meetings transcribed during the wind-down; Existing transcripts exported and the vendor account closed at expiry; Weekly check-in during migration
Expires on: 11 Sep 2026
Status: Expiring
Exit plan: Migration to the approved assistant complete and vendor account closed by 2026-09-11. Program confirms closure and records it in the log.
Linked records: TL-01

Blank template

The same fields with nothing in them. Print this page, or use the download above to get a standalone file.

ID, requester, date

Who asked and when.

Request and standard expectation

Both sides, so the gap is visible.

Approved by

The function with authority over the expectation being waived.

Compensating controls

What reduces the risk in the meantime.

Expiry date

Mandatory. An exception without one is a policy change nobody approved.

Exit plan

What has to happen, by whom, for the exception to close.

Artifact details